November 2014 - Test - lists.nanog.org

Re: Anyone else having trouble reaching thepiratebay.se? AS39138
by Courtney Smith 27 Nov '14

27 Nov '14

I just posted TATA as a single example. This route is missing from multiple networks. I could not find the specific /24 on, Sprint(1239) AT&T(7018) and Centurylink either. rviews(a)route-server.ip.att.net> show route 194.71.107.0/24 rviews(a)route-server.ip.att.net> from https://www.sprint.net/lg/lg_start.php Query Results: Sprint Source Region: New York, NY (sl-gw27-nyc) Performing: Show Route % Network not in table Completed - Wed Nov 26 21:11:51 EST 2014 Basic troubleshooting of your two example ASN's. Notice the community 174:991 on the Cogent path? Go look that up in Cogent's community guide. Level3's looking glass actually does the translation of communities for you. I'm not going to try to map out all the possible paths this prefix could be reach. At the moment, the /24 is not reachable from several networks. Either an outage or a change at AS51040 or their upstreams has caused the traffic engineering of one of the networks upstream of 51040 to break connectivity for a group of networks. from http://www.cogentco.com/en/network/looking-glass BGP routing table entry for 194.71.107.0/24, version 2977032097 Paths: (1 available, best #1, table Default-IP-Routing-Table) 5580 39138 22351 2.207 51040 38.104.73.58 (metric 10111041) from 154.54.66.76 (154.54.66.76) Origin IGP, metric 0, localpref 130, valid, internal, best Community: 174:991 174:10004 174:20999 174:21001 174:22013 Originator: 66.28.1.248, Cluster list: 154.54.66.76, 66.28.1.69, 66.28.1.103, 66.28.1.9, 154.54.66.49 Route results for 194.71.107.0/24 from Atlanta, GA BGP routing table entry for 194.71.107.0/24 Paths: (2 available, best #1) 5580 39138 22351 23456 51040 AS-path translation: { ATRATO-IP OPENAP-WIRELESS-NETWORKS-AS INTELSAT AS23456 PIRATE-AS } ear1.Atlanta2 (metric 20000) Origin IGP, metric 0, localpref 100, valid, internal, best Community: North_America Lclprf_100 Level3_Customer United_States Atlanta Level3:10074 5580:25215 Suppress_to_Peers Originator: ear1.Atlanta2 5580 39138 22351 23456 51040 AS-path translation: { ATRATO-IP OPENAP-WIRELESS-NETWORKS-AS INTELSAT AS23456 PIRATE-AS } ear1.Atlanta2 (metric 20000) Origin IGP, metric 0, localpref 100, valid, internal Community: North_America Lclprf_100 Level3_Customer United_States Atlanta Level3:10074 5580:25215 Suppress_to_Peers Originator: ear1.Atlanta2 On Nov 26, 2014, at 7:32 PM, Eric Tykwinski wrote: > Courtney, > > No offense, and I can’t really verify Comcast’s network. But Verizon peers with the same ASNs I do 3356 and 174 which both have routes to thepiratebay’s prefixes, and I can almost guarantee that Comcast has those routes within your network. What’s up really? Just because TATA is blocking routes shouldn’t effect the whole internet, or this whole thing would have been screwed a long time ago. > > Sincerely, > > Eric Tykwinski > TrueNet, Inc. > P: 610-429-8300 > F: 610-429-3222 > >> On Nov 26, 2014, at 2:11 PM, courtneysmith(a)comcast.net wrote: >> >> Only one of their /24's is in TATA's(AS6453) table. >> >> http://bgp.he.net/AS51040#_prefixes >> >> >> http://lg.as6453.net >> >> Router: gin-aeq-tcore1 >> Site: US, Ashburn, AEQ >> Command: show route protocol bgp 194.71.107.0/24 terse exact >> >> >> {master} >> >> >> Router: gin-aeq-tcore1 >> Site: US, Ashburn, AEQ >> Command: show route protocol bgp 194.14.56.0/24 terse exact >> >> >> inet.0: 520187 destinations, 3597636 routes (519993 active, 9 holddown, 1053 hidden) >> Restart Complete >> + = Active Route, - = Last Active, * = Both >> >> A V Destination P Prf Metric 1 Metric 2 Next hop AS path >> * ? 194.14.56.0/24 B 197595 51040 I >> unverified >216.6.87.1 >> ? B 197595 51040 I >> unverified >216.6.87.1 >> ? B 197595 51040 I >> unverified >216.6.87.1 >> ? B 1239 1257 197595 51040 I >> unverified >144.232.7.61 >> >> {master} >> >> >> >> >> >> >> On 11/26/14, 2:01 PM, " eric-list(a)truenet.com " < eric-list(a)truenet.com > wrote: >> >> >> Javier, >> >> >> I can't get to www.rrbone.net, an upstream provider to the IP I was given for thepiratebay.se. >> I tested on VZ FiOS and Wireless in Philadelphia area and both die within the VZ network. >> >> >> For Comcast, it looks like the space isn't showing up in the BGP table: >> route-server.newyork.ny.ibone>show ip bgp 194.71.107.27 >> % Network not in table >> >> >> No clue what the cause is, but it bigger than just the PirateBay. >> >> >> Sincerely, >> >> >> Eric Tykwinski >> TrueNet, Inc. >> P: 610-429-8300 >> F: 610-429-3222 >> >> >> >> >> -----Original Message----- >> From: NANOG [ mailto:nanog-bounces@nanog.org ] On Behalf Of Javier J >> Sent: Wednesday, November 26, 2014 1:44 PM >> To: nanog(a)nanog.org >> Subject: Re: Anyone else having trouble reaching thepiratebay.se? AS39138 >> >> >> I confirmed It is also blocked for Comcast users. Even Comcast business users. This is starting to look like censorship to me. > > Courtney Smith courtneysmith(a)comcast.net I wanna devise a virus To bring dire straits to your environment Crush your corporations with a mild touch Trash your whole computer system and revert you to papyrus

4 3

Re: kohls.com issues
by oz＠columbus.rr.com 26 Nov '14

26 Nov '14

Thanks - it's good now. Just earlier seemed to be some issues. http://www.isitdownrightnow.com/kohls.com.html Guess it could have been a hosting issue. From: Javier J <javier(a)advancedmachines.us> Date: Wednesday, November 26, 2014 at 9:25 PM To: Steven Parsons <oz(a)columbus.rr.com> Subject: Re: kohls.com issues Works for me on FIOS in the NYC area. On Wed, Nov 26, 2014 at 9:18 PM, <oz(a)columbus.rr.com> wrote: Anyone know what’s up ? Looks like they are still working thru issues where I am. Not sure if their domain was hijacked or what exactly. If someone has a list where this is already being discussed id appreciate that info. Thanks, Steve

1 0

kohls.com issues
by oz＠columbus.rr.com 26 Nov '14

26 Nov '14

Anyone know what’s up ? Looks like they are still working thru issues where I am. Not sure if their domain was hijacked or what exactly. If someone has a list where this is already being discussed id appreciate that info. Thanks, Steve

2 1

Re: Anyone else having trouble reaching thepiratebay.se? AS39138
by courtneysmith＠comcast.net 26 Nov '14

26 Nov '14

Only one of their /24's is in TATA's(AS6453) table. http://bgp.he.net/AS51040#_prefixes http://lg.as6453.net Router: gin-aeq-tcore1 Site: US, Ashburn, AEQ Command: show route protocol bgp 194.71.107.0/24 terse exact {master} Router: gin-aeq-tcore1 Site: US, Ashburn, AEQ Command: show route protocol bgp 194.14.56.0/24 terse exact inet.0: 520187 destinations, 3597636 routes (519993 active, 9 holddown, 1053 hidden) Restart Complete + = Active Route, - = Last Active, * = Both A V Destination P Prf Metric 1 Metric 2 Next hop AS path * ? 194.14.56.0/24 B 197595 51040 I unverified >216.6.87.1 ? B 197595 51040 I unverified >216.6.87.1 ? B 197595 51040 I unverified >216.6.87.1 ? B 1239 1257 197595 51040 I unverified >144.232.7.61 {master} On 11/26/14, 2:01 PM, " eric-list(a)truenet.com " < eric-list(a)truenet.com > wrote: Javier, I can't get to www.rrbone.net, an upstream provider to the IP I was given for thepiratebay.se. I tested on VZ FiOS and Wireless in Philadelphia area and both die within the VZ network. For Comcast, it looks like the space isn't showing up in the BGP table: route-server.newyork.ny.ibone>show ip bgp 194.71.107.27 % Network not in table No clue what the cause is, but it bigger than just the PirateBay. Sincerely, Eric Tykwinski TrueNet, Inc. P: 610-429-8300 F: 610-429-3222 -----Original Message----- From: NANOG [ mailto:nanog-bounces@nanog.org ] On Behalf Of Javier J Sent: Wednesday, November 26, 2014 1:44 PM To: nanog(a)nanog.org Subject: Re: Anyone else having trouble reaching thepiratebay.se? AS39138 I confirmed It is also blocked for Comcast users. Even Comcast business users. This is starting to look like censorship to me.

1 0

Craigslist hacked?
by Brian Henson 26 Nov '14

26 Nov '14

Is anyone else seeing their local craigslist redirected to another site other than craigslist? I see it loading http://digitalgangster.com/5um.

25 39

abuse reporting tools
by Mike 26 Nov '14

26 Nov '14

Hello, I provide broadband connectivity to mostly residential users. Over the past few years, instances of DDoS against the network - specfically targeting end users - has been on the rise, and today I can qualify many of these as simple acts of revenge where someone will engage a dos (possibly, services like 'booters' or similar) because they lost an online game or had some interactive in a forum they didn't like. I have good 'consumer broadband' filtering rules in place which make sense and protect against quite a lot of obviously ddos oriented traffic streams. The next step I want to engage, for those types of traffic which I can positively identify as not spoofed, is to send out abuse reports to owners of ip ranges used to launch these attacks. Ideally I'd like to be able to write up some form letter describing the attack, the source ip(s) of note, some disassembled sample packets, and then feed a list of IP source addresses and have it mail it out to the abuse contact at each source network. I am wondering if anyone has a pointer or reference to any tools which might help facillitate this? Thank you. Mike-

11 13

Re: Seeking IPv6 Security Resources
by Scott Weeks 25 Nov '14

25 Nov '14

--- cgrundemann(a)gmail.com wrote: From: Chris Grundemann <cgrundemann(a)gmail.com> I am looking for IPv6 security resources to add to: http://www.internetsociety.org/deploy360/ipv6/security/ These could be best current practice documents, case-studies, lessons-learned/issues-found, research/evaluations, RFCs, or anything else focused on IPv6 security really. I'm not requesting that anyone do any new work, just that you point me to solid public documents that already exist. Feel free to share on-list or privately, both documents you may have authored and those you have found helpful. ------------------------------ http://www.si6networks.com/tools/ipv6toolkit/index.html List of Tools •addr6: An IPv6 address analysis and manipulation tool. •flow6: A tool to perform a security asseessment of the IPv6 Flow Label. •frag6: A tool to perform IPv6 fragmentation-based attacks and to perform a security assessment of a number of fragmentation-related aspects. •icmp6: A tool to perform attacks based on ICMPv6 error messages. •jumbo6: A tool to assess potential flaws in the handling of IPv6 Jumbograms. •na6: A tool to send arbitrary Neighbor Advertisement messages. •ni6: A tool to send arbitrary ICMPv6 Node Information messages, and assess possible flaws in the processing of such packets. •ns6: A tool to send arbitrary Neighbor Solicitation messages. •ra6: A tool to send arbitrary Router Advertisement messages. •rd6: A tool to send arbitrary ICMPv6 Redirect messages. •rs6: A tool to send arbitrary Router Solicitation messages. •scan6: An IPv6 address scanning tool. •tcp6: A tool to send arbitrary TCP segments and perform a variety of TCP-based attacks. scott

1 0

eBGP Graceful-Restart and GR Helper Mode with external networks.
by Chris Costa 24 Nov '14

24 Nov '14

Is there a BCOP (or substantiated opinion) for negotiating eBGP Graceful-Restart and Graceful-Restart Helper-Mode with external networks? Implementation looks varied across a few larger transit providers, and in some cases implemented inconsistently within the same provider. Seeing most IX peers with GR disabled, although I don't see they've disabled GR Helper Mode. Apparently, Junos (12.3, at least) doesn't offer disabling GR Helper Mode for BGP. Thanks.

2 1

Re: Craigslist hacked?
by Harry Hoffman 24 Nov '14

24 Nov '14

Probably a good time to remind folks of HTTPS everywhere plugin for Chrome and Firefox :-) Cheers, Harry On Nov 24, 2014 1:04 AM, Christopher Morrow <morrowc.lists(a)gmail.com> wrote: > > On Sun, Nov 23, 2014 at 11:51 PM, Randy Bush <randy(a)psg.com> wrote: > > and what tasty things did the hijacker's web site serve? > > probably not much for very long... :( CL traffic is a bit crushy.

2 1

Help, need Verizon fiber outage phone number
by Matthew Crocker 23 Nov '14

23 Nov '14

Does anyone have a phone number for Verizon-NE (Massachusetts)? I have a fiber outage between two Verizon COs and their stupid VTAG system is worthless. I can’t get a trouble ticket entered to save my life. All of the numbers I have either go nowhere or get stuck in music on hold hell then disconnect. Thanks -Matt -- Matthew S. Crocker President Crocker Communications, Inc. PO BOX 710 Greenfield, MA 01302-0710 E: matthew(a)crocker.com P: (413) 746-2760 F: (413) 746-3704 W: http://www.crocker.com

1 0